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Cloudflare API Gateway 


Manage and secure the APIs that drive business 


Modern API challenges 


In attacker crosshairs 


APIs make the world go around. 58% of dynamic HTTP 
traffic on the Cloudflare network is APl-related. 


APIs present exciting business opportunities to deliver 
products faster and improve customer experience. 
Now, security and IT leaders have to balance securing 
their APIs, on top of their web apps, without slowing 


down innovation. Cloudflare API Gateway 


Security and IT teams need to secure their customers’ 
sensitive data while enabling business operations 
across web app and API properties. 


Customers can discover, secure and simplify their 
public API security and management by consolidating 
their web application and API protection on the 


Customer trust is at stake, after all. Cloudflare edge. 


API Gateway is part of Cloudflare's application security 
portfolio that also stops bots, thwarts DDoS attacks, 
blocks application attacks and monitors for supply 
chain attacks. 
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Shadow API risks Authentication, data loss and API performance monitoring 
abuse concerns 3 ; : 

Development teams often Given APIs drive business, once 

publish new APIs without telling Once APIs are discovered, they APIs are monitored and 

IT, so APIs are operating in the must be secured from attacks secured, companies must keep 

shadows without management and abuse with authentication, an eye on their performance: 

or security. schema validation, API abuse understand request volumes per 
protections, and data endpoint, error rates, latency. 


exfiltration detections. 
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API Management 


Discovery and schema learning Discover API endpoints in active use and their associated schemas through machine learning driven 
and heuristics based models 


Sequence and performance Uncover the most important sequences of API request behavior and analyse API endpoint performance 
analytics (e.g.: requests, latency, error rate, and response size, etc) 


Developer portal & 


management Manage interactive API documentation and host it on your domain with Cloudflare Pages 


Authentication validation Authenticate and validate API traffic with mTLS certificates, JSON web tokens (JWT), API keys, and 
OAuth 2.0 tokens to block requests from illegitimate clients. 


Schema validation Use API schemas to accept valid API requests and block malformed requests and HTTP anomalies. 
This complements Cloudflare WAF’s negative security model for comprehensive security 


Abuse detection Baseline your traffic and stop abuse with per-endpoint session-based Rate Limiting suggestions and 
GraphQL denial of service (DoS) protections 


Sensitive data detection Detect sensitive data within API responses leaving your origin and alert per-endpoint 


Integrated platform All application security (Web Application Firewall, Bot Management, API security and management, 
Page Shield, mTLS) is managed through an integrated console. 


Product benefits 


Minimize attack Improve API Reduce operational Consolidate ona 
surface risks and performance burden - time and unified 
reduce cyber risk costs performance and 


security platform 
across web apps 
and APIs 
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Cloudflare API Gateway 


©} Visibility & Management 


API discovery, sequence 
analytics and performance 
management 
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© Positive Security Model 


Schema validation, JWT 
validation and mTLS 
certificates 


"eard": 
*wycard_reforonce" 
) 


API Call 


Abuse Protection 
Intelligent rate limiting, volumetric 
abuse protection and GraphQL 

protection 
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Figure 1: Cloudflare API Gateway Architecture 


Cloudflare Leadership 


The Cloudflare application security portfolio has received 
numerous accolades for its strength and breadth. Gartner 
named Cloudflare a leader in the 2022 Gartner® Magic 
Quadrant™ for Web Application and API Protection (WAAP). 
Forrester named Cloudflare a leader in the 2022 Forrester Wave 
for Web Application Firewalls. 
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